From nobody@FreeBSD.org  Sun Mar  4 23:58:19 2007
Return-Path: <nobody@FreeBSD.org>
Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52])
	by hub.freebsd.org (Postfix) with ESMTP id 439A116A400
	for <freebsd-gnats-submit@FreeBSD.org>; Sun,  4 Mar 2007 23:58:19 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (www.freebsd.org [69.147.83.33])
	by mx1.freebsd.org (Postfix) with ESMTP id 3428F13C478
	for <freebsd-gnats-submit@FreeBSD.org>; Sun,  4 Mar 2007 23:58:19 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from www.freebsd.org (localhost [127.0.0.1])
	by www.freebsd.org (8.13.1/8.13.1) with ESMTP id l24NwINk003580
	for <freebsd-gnats-submit@FreeBSD.org>; Sun, 4 Mar 2007 23:58:18 GMT
	(envelope-from nobody@www.freebsd.org)
Received: (from nobody@localhost)
	by www.freebsd.org (8.13.1/8.13.1/Submit) id l24NwIjO003579;
	Sun, 4 Mar 2007 23:58:18 GMT
	(envelope-from nobody)
Message-Id: <200703042358.l24NwIjO003579@www.freebsd.org>
Date: Sun, 4 Mar 2007 23:58:18 GMT
From: Wada Keiji<keiji@hiemalis.org>
To: freebsd-gnats-submit@FreeBSD.org
Subject: 6-STABLE panic kern_timeout.c
X-Send-Pr-Version: www-3.0

>Number:         109889
>Category:       kern
>Synopsis:       [panic] 6-STABLE panic kern_timeout.c
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Mar 05 00:00:18 GMT 2007
>Closed-Date:    Wed Feb 09 15:59:22 UTC 2011
>Last-Modified:  Wed Feb 09 15:59:22 UTC 2011
>Originator:     Wada Keiji
>Release:        6-STABLE
>Organization:
>Environment:
FreeBSD lettuce.hiemalis.org 6.2-STABLE FreeBSD 6.2-STABLE #0: Fri Feb 16 17:57:11 JST 2007     keiji@lettuce.hiemalis.org:/home/lettuce/keiji/ftp/HARD/yacxm/sys/i386/compile/LETTUCE-SMP  i386
>Description:
kgdb kernel.debug vmcore.2
[GDB will not be able to debug user-mode threads: /usr/lib/libthread_db.so: Unde
fined symbol "ps_pglobal_lookup"]
GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-marcel-freebsd".

Unread portion of the kernel message buffer:
kernel trap 12 with interrupts disabled


Fatal trap 12: page fault while in kernel mode
cpuid = 0; apic id = 00
fault virtual address   = 0x65656c7b
fault code              = supervisor read, page not present
instruction pointer     = 0x20:0xc068a812
stack pointer           = 0x28:0xe34b1ca4
frame pointer           = 0x28:0xe34b1cd0
code segment            = base 0x0, limit 0xfffff, type 0x1b
                        = DPL 0, pres 1, def32 1, gran 1
processor eflags        = resume, IOPL = 0
current process         = 13 (swi4: clock sio)
trap number             = 12
panic: page fault
cpuid = 0
Uptime: 1d10h4m54s
Dumping 1014 MB (2 chunks)
  chunk 0: 1MB (159 pages) ... ok
  chunk 1: 1015MB (259632 pages) 999 983 967 951 935 919 903 887 871 855 839 823
 807 791 775 759 743 727 711 695 679 663 647 631 615 599 583 567 551 535 519 503
 487 471 455 439 423 407 391 375 359 343 327 311 295 279 263 247 231 215 199 183
 167 151 135 119 103 87 71 55 39 23 7

#0  doadump () at pcpu.h:165
165             __asm __volatile("movl %%fs:0,%0" : "=r" (td));
(kgdb) list *0xc068a812
0xc068a812 is in softclock (../../../kern/kern_timeout.c:220).
215                     curticks = softticks;
216                     bucket = &callwheel[curticks & callwheelmask];
217                     c = TAILQ_FIRST(bucket);
218                     while (c) {
219                             depth++;
220                             if (c->c_time != curticks) {
221                                     c = TAILQ_NEXT(c, c_links.tqe);
222                                     ++steps;
223                                     if (steps >= MAX_SOFTCLOCK_STEPS) {
224                                             nextsoftcheck = c;
(kgdb) backtrace
#0  doadump () at pcpu.h:165
#1  0xc067deca in boot (howto=260) at ../../../kern/kern_shutdown.c:409
#2  0xc067e1f1 in panic (fmt=0xc08f60be "%s")
    at ../../../kern/kern_shutdown.c:565
#3  0xc089903c in trap_fatal (frame=0xe34b1c64, eva=1701145723)
    at ../../../i386/i386/trap.c:837
#4  0xc08987ae in trap (frame=
      {tf_fs = -1066860536, tf_es = -1063321560, tf_ds = -995426264, tf_edi = -9
95061504, tf_esi = 4, tf_ebp = -481616688, tf_isp = -481616752, tf_ebx = 6, tf_e
dx = -659544456, tf_ecx = 1701145715, tf_eax = 122700741, tf_trapno = 12, tf_err
 = 0, tf_eip = -1066883054, tf_cs = 32, tf_eflags = 65538, tf_esp = -995386752,
tf_ss = 0}) at ../../../i386/i386/trap.c:270
#5  0xc0884b0a in calltrap () at ../../../i386/i386/exception.s:139
#6  0xc068a812 in softclock (dummy=0x0) at ../../../kern/kern_timeout.c:220
#7  0xc06686b9 in ithread_execute_handlers (p=0xc4ab8648, ie=0xc4b09100)
    at ../../../kern/kern_intr.c:682
#8  0xc06687c9 in ithread_loop (arg=0xc4a908a0)
    at ../../../kern/kern_intr.c:765
#9  0xc066746d in fork_exit (callout=0xc0668774 <ithread_loop>,
    arg=0xc4a908a0, frame=0xe34b1d38) at ../../../kern/kern_fork.c:821
#10 0xc0884b6c in fork_trampoline () at ../../../i386/i386/exception.s:208
(kgdb) quit

The SMP kernel panic at about 1day after reboot.

>How-To-Repeat:
About A day after, kernel panic.

>Fix:
I don't know.

>Release-Note:
>Audit-Trail:
State-Changed-From-To: open->feedback 
State-Changed-By: jh 
State-Changed-When: Sun Dec 12 09:48:01 UTC 2010 
State-Changed-Why:  
Can you still reproduce this on recent FreeBSD versions? 

http://www.freebsd.org/cgi/query-pr.cgi?pr=109889 
State-Changed-From-To: feedback->closed 
State-Changed-By: jh 
State-Changed-When: Wed Feb 9 15:59:21 UTC 2011 
State-Changed-Why:  
Feedback timeout. 

http://www.freebsd.org/cgi/query-pr.cgi?pr=109889 
>Unformatted:
